Back in May, I pulled my new copy of Entertainment Weekly out of the mailbox and flipped through it quickly, as I usually do before sitting down to read the whole thing. An article about an unusual premier of a new TV show called Mr. Robot caught my eye. The cyberthriller’s pilot episode was set to make its debut online and through alternative viewing services like Xfinity On Demand, iTunes, Amazon Instant Video, XBOX, and Google Play almost a month earlier than its USA Network television debut on June 24.
Mr. Robot tops all the ‘Best TV show of 2015′ lists
The next Monday morning, I shared the news about the show with my colleagues, and we all vowed to watch the new drama about a cybersecurity expert who joins an underground hacker group, as soon as we could. We hoped it would be a more realistic version of the security issues we face today than CSI: Cyber or any number of Hollywood movies. We even contemplated having a weekly viewing party with Avast Virus Lab researchers and getting their comments live, a la Mystery Science Theater 3000, if the show was good.
A twist in the plot
The very next day after the initial discussion, one of my colleagues, and regular blog writer, Stefanie Smith, received an email from a Mr. Robot production staff member asking if we would be interested in having an Avast antivirus product make an appearance on one of the upcoming episodes. At the time, a few weeks before the pilot episode even aired, this was a difficult call – but our decision to be a part of the show, even for a brief moment, proved to be the right one.
Mr. Robot has consistently been named one of 2015’s best TV shows, and it received Golden Globe nominations for Best Series, Best Actor for Rami Malek, and Best Supporting Actor for Christian Slater.
We didn’t watch it together with the Virus Lab guys, but every week after the show, we got their expert opinions about the hacks depicted on Mr. Robot. Here’s some of our favorite moments from season one:
1. Avast guest stars on Mr. Robot
The show’s protagonist, Elliot, attempts to hack into a prison’s network, and fellow hacker, Darlene, helps him by uploading an exploit onto USB sticks. She drops the sticks on the ground, and a police officer picks one up and foolishly inserts it into his work PC. The idea was to inject a customized payload to compromise and gain access to the prison’s network – and then BAM! Avast detects the exploit!
2. Operation Meltdown
via USA Network
Elliot wants to control the Steel Mountain secure data facility’s climate control system to overheat it, thus melting ECorp’s tape-based backup. He uses a complicated gateway-impersonating MiTM (man in the middle) attack, ‘Raspberry Pi’, to accomplish his goal. He eventually connects Raspberry Pi to Steel Mountain’s heating and cooling systems. This 3xpl0its.wmv plot is reminiscent of the point of entry in the real-world Target attack.
3. “People make the best exploits”
via USA Network
One of cybercrooks most successful methods is social engineering; psychological techniques used to exploit human weaknesses. Throughout the show’s episodes we saw examples of this technique. Even among the more sophisticated hacks, these are the ones that freaked us out the most.
Hackers want your personal information
Elliot uses a password-cracking tool many times on the show. On one occasion, he wants to hack his therapist’s new boyfriend, Michael. He calls Michael pretending to be from his bank’s fraud department, confirming his address and asking him security questions to verify his account: What is his favorite baseball team? His pet’s name? Using the information he gathered combined with a dictionary brute force attack, which systematically checks all possible passwords until the correct one is found, Elliot hacks Michael’s account.
Hackers want to steal company data
In episode d3bug.mkv, one of Elliot’s colleagues, Ollie, received a music CD from a fake rapper that turns out to have malware on it. The infection that resulted gave ‘The Dark Army’ access to Ollie’s laptop webcam which was used to spy on him and his girlfriend, Angela. The hacker tells Ollie he has photos of Angela, and even Angela’s and her dad’s banking information and social security number. He threatens to blackmail Ollie if he does not spread the malware within his employer, Allsafe’s, systems.
4. Mobile devices are vulnerable
via USA Network
ECorp baddie, Tyrell, uses a backdoor to get into assistant Anwar’s Android device to install an app that could allow remote access. It’s not strictly necessary to root the phone – just gaining physical access to the phone is all he needed. In this episode, Tyrell used an SD card with an application called RooterFrame to gain access, but the actual Android APK is Framaroot.
Elliot needs to remove a hacked server in episode wh1ter0se.m4v, but has to do it by creating an Allsafe service ticket. This request requires his boss, Gideon, to send the ticket, and he uses two-factor authentication to receive a temporary, second code sent to his phone. Elliot asks Darlene to send Gideon’s phone hundreds of MMS files to drain the battery, forcing him to charge it- and leave it in his office unattended. Elliot takes physical possession of the device, gets the security token and logs into Gideon’s account to submit a request to take down the server.
5. Real-life physical hacks
Elliot picks the bathroom lock. He explains that “the lock-pick is every hacker’s favorite sport. Unlike virtual systems, when you break it you can feel it.”
Follow Avast on Facebook, Twitter, YouTube, and Google+ where we keep you updated on cybersecurity news every day.
